CVE-2026-93829

The Linux kernel contains a vulnerability in the smb: client component related to races in cifsd thread creation . Specifically, the cifsd demultiplex thread can access tcp_ses before the parent thread finishes populating it, as it is accessed locklessly. Additionally, the kthread_run macro may s...

EUVD-2026-86218

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix races in cifsd thread creation The cifsd demultiplex thread can run and access tcpses before the parent thread has finished populating tcpses, which the worker thread accesses locklessly. Also, the kthreadrun mac...

CVE-2026-93801

A vulnerability exists in the Linux kernel smb/client where the stack-allocated cifs_open_info_data structure is not properly zero-initialized. Because the structure may contain random data from the stack, certain fields could hold incorrect values if they are not explicitly set during execution....

EUVD-2026-86188

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

CVE-2026-93794

The Linux kernel contains a vulnerability in the smb/client component where punching a hole after a large buffered write can result in the range being incorrectly reported as data. This occurs because a dirty folio spanning the punched range can be written back after the punch, refilling the hole...

EUVD-2026-86181

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

CVE-2026-93210

The Linux kernel contains a vulnerability in the SMB client component where the DFS cache is not properly hardened against invalid target hints. Specifically, the get_tgt_name() function returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, while dfs_cache_noreq_update_tgthint() incorrectly assum...

kernel: smb: client: fix double-free in SMB2_flush() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

kernel: smb: client: fix double-free in SMB2_flush() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

Blackash-CVE-2025-33073

✨ CVE-2025-33073: Vulnerabilidad de RCE en Windows SMB 🚨 🔥 Ejecución remota de código autenticada de alta gravedad 🔥 Control de acceso inadecuado en el cliente SMB de Windows CWE-284 🛡️ Detalles clave de un vistazo...

cifswitch-check

cifswitch-check Un script de shell para comprobar si un sistema Linux está expuesto a CIFSwitch CVE-2026-46243 — una vulnerabilidad de escalada de privilegios local en el cliente CIFS/SMB del kernel de Linux que existe desde 2007. Se ejecuta en hosts de metal desnudo, máquinas virtuales y dentro ...

ROS-20260923-73-0030

The vulnerability of the fs/smb/client component in the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260923-73-0053

The vulnerability of the parsedfsreferrals function in the fs/smb/client/misc.c module of the SMB client support library in the Linux operating system is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-33073

CVE-2025-33073 — Escalada de Privilegios por Reflexión NTLM en el Cliente SMB de Windows Informe de investigación por Sentinel AI Defense. Solo análisis defensivo — no se publica ningún exploit funcional ni PoC aquí. Una falla de control de acceso inadecuado en el Cliente SMB de Windows que reviv...

K000163366: Linux kernel vulnerability CVE-2026-31613

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUSSTOPPEDONSYMLINK, smb2checkmessage returns success without any length validation, leaving the symlink parsers as...

CVE-2026-46243

🚨 CVE-2026-46243 - CIFSwitch Escalada de Privilegios Local del Kernel de Linux LPE Vulnerabilidad de escalada de privilegios local que afecta al cliente CIFS/SMB del kernel de Linux. 📖 Resumen CVE-2026-46243 es una vulnerabilidad de escalada de privilegios local LPE dentro del cliente CIFS/SMB de...

kernel: smb: client: fix double-free in SMB2_open() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2open replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same...

AZL-102230 CVE-2026-90125 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...

DEBIAN-CVE-2026-90125

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix request buffer leak in smb2newreadreq smb2newreadreq allocates the request buffer with smb2plainreqinit but only publishes it to the caller with buf = req at the very end of the function. Two error returns sit in...

CVE-2026-90125

CVE-2026-90125 is a request buffer leak in the Linux kernel's SMB client , specifically in smb2_new_read_req(). The function allocates a buffer via smb2_plain_req_init() but fails to release it on two early error returns: a failed initialization and a failed smbd_register_mr() call. Because -EAGA...